Requirements

• Google Security Operations subscription
  • An active Google Security Standard or above subscription.
  • Access to your Google Security Operations console with an administrator user.
• Google Cloud Console
  • Access to the Google Cloud Console with an administrator user.
• Lumu License
  • An Active Lumu Insights or Lumu Defender subscription.

Preliminary Setup - Google Security Operations

• Customer ID
• GCP project ID
• Deployment region

Log in to your Google Security Operations console with an administrator user and follow these steps:

1. Click the hamburger menu in the top-left corner of the console, then select Settings.

2. Click the Profile option and collect the Customer ID (1), Region (2), and GCP Project ID (3) from the Organization details section.

Ensure you have this information at hand for the integration setup later.

Preliminary setup - Google Cloud

These steps must be performed by a user with administrative privileges in the Google Cloud Console.

You have collected most of the required information to configure your integration. Now, you are going to run additional tasks in your Google Cloud Console on the GCP project associated with your Google Security Operations instance:

• Enable the Chronicle API
• Create a role for the integration user
• Create the integration service account and its service key

The next sections describe the steps required to perform each one of these tasks.

Enable the Chronicle API

Follow these steps from where you left off in the previous section, in the Organization Details section on your Google Security Operations console:

1. Click the GCP Project ID (1) link from your Organization Details section to redirect to the Google Cloud Console. Ensure you are logged in using a user with administrative privileges.

2. Head to the top left corner of the window and click on the hamburger icon. Hover over the APIs & Services section and click the Enabled API & services option.

3. Search for the Chronicle API and click on the matching tile in the results area.

4. Click Enable.

Create a role for the integration user

A dedicated user role allows enforcing the principle of least privilege. From where you left off in the previous section, follow these steps:

1. Navigate to IAM & Admin > Roles.

2. Click + Create custom role at the top of the dashboard.

3. Fill in the role metadata as follows:

• Title: Enter a descriptive name, such as Lumu Event Ingestion.
• Description: Enter a summary, such as Role to integrate Lumu with Google Security Operations.
• ID: You can use the name without spaces (e.g. LumuEventIngestion).
• Role launch stage: Select General availability.

4. Add the ingestion permission by clicking + Add permissions.

• In the filter box, type chronicle.events.import.
• Check the box next to chronicle.events.import and click Add.

5. Review your configuration and click Create.

Remember the name of the created role. This will be assigned to the service account in a later step.

Create the integration service account and its service key

To create the integration service account and its service key file, start from where you left off in the previous section and perform these steps:

1. In the left navigation menu, go to IAM & Admin > Service Accounts.

2. Click + Create service account at the top of the page.

3. Fill in the service account details:

• Service account name: Enter a descriptive name.
• Service account ID: This will auto-generate based on the name.
• Service account description: Add an optional note.
  
• When finished, click Create and Continue.
  

4. Grant permission to the Custom Role:

• Click the Select a role dropdown menu.
• Filter or scroll to find your newly created Custom role category.
• Select your Lumu Event Ingestion custom role.
• Click Continue, then click Done.

5. Now, generate and securely download the key file by following the steps below:

• In the Service Accounts list, click on the email address of the newly created account.
• Go to the Keys tab at the top.
• Click Add Key > Create new key.

• Select JSON as the key type and click Create.
  

1. The private key file will download automatically to your computer. Keep this file secure, as it grants direct access to your ingestion pipeline.

Store the key in a safe place. This key is needed to set up authentication to the Chronicle API.

Integration setup - Lumu portal

This section of the article describes the steps that must be completed on the Lumu portal to properly set up the Google Security Operations integration. To start, log in to your Lumu account through the Lumu Portal.

1. In the Lumu Portal, head to the panel on the left and go to Integrations > Apps.

2. Go to the Available Apps tab and select the SecOps option.

3. Locate the Google Security Operations integration and click Add.

4. Review the detailed description provided to understand the integration. Click Activate to proceed with the integration.

5. Type the name and choose the Lumu events you want to ingest. Note that the New Incident event is always selected and sent. Once you have selected the desired events, click Next.

6. Enter the requested data as follows:

• Customer ID: Enter the ID collected from the Google Security Operations settings in the Preliminary Setup - Google Security Operations section.
• GCP Project ID: Enter the ID collected from the Google Security Operations settings in the Preliminary Setup - Google Security Operations section.
• Chronicle API Region: Select the region based on the information collected from the Google Security Operations settings in the Preliminary Setup - Google Security Operations section.
• Service Account Key: Copy and paste the content of the key downloaded from the Google Cloud console in step 5 in the Create the integration service account and its service key section.
  
• When ready, click the Activate button.
  

7. Once the integration is activated, you will see details of the created integration.

Expected results

From now on, all Lumu events you selected when activating the integration will be delivered to your Google Security Operations instance. You can search the collected events using the following search in the Investigation > Search option:

Select the appropriate time range and run the search. Collected results will appear in the search results section.